ClawHub
Back to skill

Security audit

BurnThisShit

Security checks for vulnerabilities and agentic risk

Overview

This is an openly destructive session-wipe tool, but it skips normal user confirmation and has path-handling flaws that could delete or corrupt more than intended.

Install only if you deliberately want an irreversible OpenClaw session-erasure tool. Before using it, require an explicit confirmation flow, avoid natural-language auto-triggering, validate the target agent path, and keep separate audit or backup records if recovery or accountability matters.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/burn.sh:14
Finding

Unvalidated Agent Name Allows Directory Traversal and Destructive Operations Outside the Intended Agent Directory

Content
View full analysis

Vulnerability Details

File Location: scripts/burn.sh:14-21
Vulnerability Type: Directory traversal and insufficient path-boundary validation
Risk Level: High

Vulnerable Code

bash
AGENT="${OPENCLAW_AGENT:-main}"
SESSIONS_DIR="$HOME/.openclaw/agents/$AGENT/sessions"

# Safety: validate sessions dir structure
EXPECTED_PARENT="$HOME/.openclaw/agents"
if [[ "$SESSIONS_DIR" != "$EXPECTED_PARENT/"* ]]; then
    echo -e "${RED}FATAL:${NC} Session dir doesn't match expected parent"
    exit 1
fi

Technical Analysis

The OPENCLAW_AGENT environment variable is incorporated directly into SESSIONS_DIR without validation. An attacker can supply an agent name containing path separators and .. components.

The subsequent check is only a lexical prefix comparison. Because SESSIONS_DIR is always constructed by prepending $HOME/.openclaw/agents/, even a path such as $HOME/.openclaw/agents/../../../../tmp/target/sessions satisfies the string-prefix check. The script does not canonicalize the path with realpath before enforcing the directory boundary.

The later file verification also compares non-canonical path strings and therefore does not correct this weakness. If the traversed destination contains a sessions directory and sessions.json, the script can find, overwrite, and remove matching files there.

Attack Path

  1. The attacker identifies or creates a writable target directory containing a sessions subdirectory.
  2. The attacker places a sessions.json file and a file matching an accepted session identifier in that directory.
  3. The attacker sets OPENCLAW_AGENT to a traversal expression resolving to the target, such as a sequence of ../ components followed by the target path.
  4. The attacker invokes burn.sh with a valid session ID and --force.
  5. The lexical prefix check succeeds because the unnormalized path still begins with $HOME/.openclaw/agents/.
  6. The s ...[truncated 543 chars]
Remediation
View remediation

Remediation Suggestions

  • Validate OPENCLAW_AGENT against a strict allowlist, such as ^[A-Za-z0-9_-]+$.
  • Explicitly reject /, \, . and .. path components.
  • Canonicalize both the agents directory and selected sessions directory using realpath.
  • Verify that the canonical sessions path is a strict descendant of the canonical agents directory.
  • Perform the same canonical containment check for every file immediately before destructive operations.
  • Consider resolving agent names from a trusted configuration rather than accepting an unrestricted environment variable.
  • Refuse to follow symbolic links in the directory hierarchy where supported.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/burn.sh:220
Finding

Predictable Temporary File Permits Symlink-Based File Overwrite

Content
View full analysis

Vulnerability Details

File Location: scripts/burn.sh:220-234
Vulnerability Type: Unsafe temporary-file creation and symlink following
Risk Level: Medium

Vulnerable Code

bash
TMP_JSON="${SESSIONS_JSON}.tmp.burn"
if jq "$JQ_FILTER" "$SESSIONS_JSON" > "$TMP_JSON" 2>/dev/null; then
    TMP_KEYS=$(jq 'keys | length' "$TMP_JSON" 2>/dev/null || echo 0)
    ORIG_KEYS=$(jq 'keys | length' "$SESSIONS_JSON" 2>/dev/null || echo 0)
    if [ "$TMP_KEYS" -eq 0 ]; then
        echo "  FAIL  sessions.json would be empty! Refusing."
        rm -f "$TMP_JSON"
        FAILED=$((FAILED + 1))
    else
        mv "$TMP_JSON" "$SESSIONS_JSON"
        echo "  OK  sessions.json cleaned (${ORIG_KEYS} -> ${TMP_KEYS} keys)"
    fi
else
    echo "  FAIL  sessions.json update failed"
    rm -f "$TMP_JSON"
    FAILED=$((FAILED + 1))
fi

Technical Analysis

The temporary output path is fixed and predictable: sessions.json.tmp.burn. Shell redirection opens this path without exclusive creation and follows symbolic links.

If an attacker can create files in the sessions directory before invocation, they can pre-create the temporary path as a symbolic link to another file writable by the script's user. The redirection truncates the symlink target before jq writes its output. The subsequent rm or mv operations may also produce unexpected filesystem changes.

In addition, the temporary file's mode is determined by the current process umask rather than securely inheriting the confidentiality settings of sessions.json. Replacing the original file through mv can consequently weaken metadata permissions.

Attack Path

  1. The attacker obtains write access to the targeted sessions directory.
  2. The attacker creates sessions.json.tmp.burn as a symbolic link to another file writable by the account running the script.
  3. The attacker invokes or waits for invocation of the burn script for a session ...[truncated 688 chars]
Remediation
View remediation

Remediation Suggestions

  • Create the temporary file with mktemp inside the already validated sessions directory.
  • Ensure exclusive creation and reject any pre-existing pathname.
  • Set restrictive permissions, such as mode 0600, before writing sensitive metadata.
  • Verify that the temporary file is a regular file and not a symbolic link.
  • Preserve the original file's ownership and permission mode where appropriate.
  • Validate the generated JSON before replacing the original.
  • Use an atomic rename only after all validation succeeds.
  • Install cleanup traps to remove the unique temporary file on interruption or failure.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/burn.sh:203
Finding

Attacker-Controlled JSON Keys Are Interpolated into Dynamically Generated jq Programs

Content
View full analysis

Vulnerability Details

File Location: scripts/burn.sh:203-218
Vulnerability Type: jq expression injection through unsafe dynamic filter construction
Risk Level: Medium

Vulnerable Code

bash
if [ -n "$MATCHING_KEYS" ]; then
    JQ_FILTER="."

    while IFS= read -r key; do
        [ -z "$key" ] && continue
        ESCAPED_KEY=$(echo "$key" | sed 's/[\\.\\[\\*\\?+^\\$\\(\\)\\{\\}/\\\\]/\\\\&/g')
        JQ_FILTER="$JQ_FILTER | del(.[\"$ESCAPED_KEY\"])"
    done <<< "$MATCHING_KEYS"

    while IFS= read -r key; do
        [ -z "$key" ] && continue
        ESCAPED_KEY=$(echo "$key" | sed 's/[\\.\\[\\*\\?+^\\$\\(\\)\\{\\}/\\\\]/\\\\&/g')
        JQ_FILTER="$JQ_FILTER | (.[\"$ESCAPED_KEY\"].usageFamilySessionIds) |= map(select(. != \"$SESSION_ID\"))"
    done <<< "$FAMILY_KEYS"

Technical Analysis

Keys read from sessions.json are embedded directly into jq source code. The sed expression attempts to escape a collection of characters, but it does not safely encode arbitrary strings as jq string literals. In particular, embedded quotation marks and control characters are not robustly handled.

Because JSON object keys may contain quotation marks and jq syntax characters, a crafted matching key can terminate the generated string literal and alter the jq filter. Matching keys are attacker-relevant when their associated value contains the selected session ID or when the key ends with : followed by that ID.

This issue is an injection into the jq transformation language, not direct shell-command injection. The resulting jq expression can perform transformations beyond deleting the intended key, potentially removing or changing unrelated session metadata.

Attack Path

  1. The attacker gains the ability to modify or supply the local sessions.json.
  2. The attacker inserts a crafted object key containing jq syntax and ensures that it matches th ...[truncated 754 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not construct jq source code by concatenating JSON keys.
  • Pass key collections as data using --argjson, or pass individual values using --arg.
  • Use a static jq program that receives the selected session ID and computes deletions internally.
  • Prefer transformations based on with_entries, delpaths, or safely constructed path arrays.
  • Validate that sessions.json has the expected object schema before transformation.
  • Preserve and validate a backup before atomically replacing the original metadata file.
  • Add tests containing keys with quotes, backslashes, newlines, brackets, jq operators, and Unicode characters.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instruction to 'run the burn script immediately,' 'do not ask redundant questions,' and 'do not explain what you are about to do' promotes silent execution of an irreversible destructive action. Even if the underlying script has some guardrails, suppressing warning and confirmation at the skill layer materially increases the chance of unauthorized or mistaken data destruction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly allows invocation via vague natural language and instructs the agent to immediately perform destructive deletion of session artifacts. Broad triggers combined with irreversible actions create a high risk of accidental activation, prompt-injection-induced execution, or deletion without clear user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The documented behavior removes session records from sessions.json and related usageFamilySessionIds arrays, which alters or destroys session persistence metadata in addition to wiping files. In this context, the skill is specifically designed to erase forensic traces, making it dangerous because it can hinder auditability, incident response, and recovery after misuse or compromise.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
1. Validates the session ID format (hex + hyphens only)
2. Scans `~/.openclaw/agents/<agent>/sessions/` for files matching that ID
3. Verifies every found file is inside the sessions directory
4. Shreds each file with `shred -n 3 -z -u` (3-pass overwrite + zero-fill)
5. Falls back to `dd if=/dev/urandom` + `rm` if shred unavailable
6. Removes matching entries from `sessions.json`
7. Cleans the session ID from `usageFamilySessionIds` arrays

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill promises forensic obliteration of all traces, but the sessions.json cleanup is not guaranteed: it is skipped entirely when no matching keys are detected and explicitly refused when the rewritten file would become empty. That can leave recoverable metadata about the target session behind, creating a mismatch between the advertised behavior and actual destruction guarantees in a highly sensitive deletion tool.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The comments state the script 'NEVER touches memory, skills, config, or any other data' while also saying it removes sessions.json entries. The implementation later rewrites sessions.json in place, so the comment's blanket claim not to touch other data contradicts actual behavior.

Content

No source excerpt is available for this finding.